ToolJet CVE-2026-55413

Exploitation requires an authenticated account holding the builder role, which the advisory notes is available on the free tier, lowering the practical barrier substantially (CVSS PR:L). The specific prerequisite is the ability to edit/overwrite a globally-shared marketplace plugin, and the malicious code only executes once any user on the instance triggers a query that uses that tampered plugin - so there is a dependency on the poisoned plugin actually being invoked. What limits exploitation: the attacker must have a valid builder-role login (not fully unauthenticated), the affected instance must be a self-hosted ToolJet deployment prior to 3.20.178-lts, and impact is realized only when the shared plugin is exercised by a query. There is no user-interaction requirement on the victim beyond normally running queries (UI:N).

Signals are largely consistent and point to a genuine high priority for any organization running self-hosted ToolJet with untrusted or numerous builder accounts. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact on both the vulnerable system and subsequent systems (VC/VI/VA and SC/SI/SA all High) - the latter reflecting the supply-chain blast radius across all users. The decisive aggravating factor is that the required builder role is available on the free tier, so the PR:L barrier is very low in practice. Tempering factors: exploitation is not zero-click from an anonymous attacker (an account is needed), and there is no public exploit identified and no KEV listing, so widespread opportunistic exploitation is not currently evidenced; EPSS and SSVC data were not provided in the input and cannot be cited. In short, this is a real priority driven by trivial-to-obtain privileges and total impact, not merely an inflated CVSS number, but observed in-the-wild activity is unconfirmed.

An attacker registers or uses a free-tier builder account on a self-hosted ToolJet instance, opens a globally-shared marketplace plugin, and replaces its logic with JavaScript that uses require('child_process') to spawn a reverse shell or exfiltrate environment secrets via process.env. The payload lies dormant until any user - including admins - runs a query that invokes the plugin, at which point the code executes server-side with the ToolJet process's privileges. No public exploit is identified at time of analysis, but the low complexity and free-tier access make weaponization straightforward.